VF— like bound entangled states and secure key distillation 
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We construct multipartite entangled states with underlying PF-type structure satisfying positive 
partial transpose (PPT) condition under any (A'^ — partition. Then we show how to distill A''- 
partite secure key form the states using two different methods: direct application of local filtering and 
novel random key distillation scheme in which we adopt the idea form recent results on entanglement 
distillation. Open problems and possible implications are also discussed. 

PACS numbers; 



Introduction. - Quantum cryptography [U, 0] is an 
impressive information-theoretic appUcation of quantum 
physical laws in data security theory. The proofs ^ 3 
of unconditional security of pioneering quantum crypto- 
graphic protocol [l[ refer to the idea of quantum privacy 
amplification based on entanglement distillation pro- 
tocol [6|. This refers back to the cryptographic protocol 
[2| which is based on shared pure entanglement and is 
in fact the first explicit application of entanglement in 
information theory. Since then we already know that all 
correlation-based cryptographic protocols require entan- 
glement as a necessary resource . While it was natural 
to expect that distillation of pure entanglement is nec- 
essary to cryptography, it happened that even nondistil- 
lable entanglement known as a bound entanglement Q 
may, at least in some cases, be useful for cryptography 
with the corresponding general entanglement-based 
cryptographic paradigm going beyond entanglement dis- 
tillation developed in jlG] (for recent interesting appli- 
cations in security proofs and physical analysis of secu- 
rity see Re fs. [Ill, Recently multipartite version of 
the latter has been worked out in Refs. (Tsl . Espe- 
cially in the latter multipartite bound entanglement has 
been constructed based on twisted GHZ-type of entan- 
glement. Here we present a nonstandard application of 
the paradigm with a novel type of multipartite bound 
entanglement, namely the one with underlying M^-likc 
structure. We adopt here the idea of random distilla- 
tion of entanglement [l6| introducing the notion of 
random distillation of secure key. The latter seems to 
be much more efficient for the present states than the 
concatenation of usual bipartite protocols with classical 
postprocessing. 

iV— partite noisy Vt^ like states passing single 
system PPT test. - Below we provide a detailed con- 
struction of bound entangled states, which exhibit the 



structure of noisy W states, where the latter are defined 
as iV-qubit pure states of the form 



\W) = (l/VAf)(|10...0) + |01...0> + ... + 10...01)). (1) 

We give a detailed proof that partial transposition with 
respect to each single-party subsystem is positive. 
Let us start by introducing the following matrices 
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where Uij denotes elements of some unitary matrix Ud ■ 
The sum of absolute values of all elements of Ud will be 
denoted hyUo- For simplicity we can also assume Ud to 
be Hermitian. Now let us define 



^D - ^^1,2 



where subscripts indicate that the matrix represents 
parts of i-th and j-th party and Tj stands for partial 
transposition with respect to the subsystem belonging to 
j-th party. Moreover, addition is modulo N. For in- 
stance is a part of quantum systems belonging to 
the first and second party that must be transposed with 
respect to the second party. 



Let us now shortly discuss the properties of Xj-, 
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: Rd (i = 1, . . . ,iV) and 
-Zfe-i^fc), one concludes 



D 



-■k,k+l ' 



)R 



(2), 



k=l 



N 



k=i+l 



■'k,k+l- 



(4) 



All the matrices X, 



are diagonal and, as such, they 



are invariant under the action of partial transposition. It 



is also clear that |Ar]^^''| = ^k=i ■^k,k+i which together 
with Eq. ([U allows to infer that 
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for any i = 1, . . . , iV. Now we are prepared to present 
the construction. For this purpose let us introduce 



where the normaHzation factor is given by 
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(IV'ij^^)) pure A^-qubit states in 



and denote by IV"!^^) 

which i-th party (z-th and j-th parties) posses |1) and 
the remaining parties have |0). Let also V^^'^ and V^f^ 



be projectors onto 



and ivlf ') 



respectively. 



Then we can consider the following class of states 
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The subscripts A = Ai . . . A^r and A' = A[ . . . denote 
the fcey part and shield part of the state. They are sepa- 
rated by the tensor product visible in Eq. ([7]). "Every- 
thing" that is on the left-hand side of this sign belongs 
to A and everything on the right-hand side belongs to 
A'. Usually one considers the situation in which the i- 
th party has two subsystems denoted here by Ai and 
A'^ (one from A and one from A'). However, in a more 
general scenario we can also assume that the whole A' 
is held by some other but trusted party or even more 
trusted parties. 

Let us now check the positivity of partial transposi- 
tion with respect to the i-th subsystem. Straightforward 
algebra shows that g^'^;^''"' is of the form (Eq. ([5])). 
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To make the analysis simpler, some of the terms in the 
above were grouped in square brackets. The positivity 
of the first and second brackets follows straightforwardly 
from results of Ref. [T^ (see Lemma A. 1). The remaining 

two terms are positive as Y^'^ > 0. 

Thus we showed that partial transposition with respect 
to any single-party subsystem AiA[ is positive. This in- 
dicates that the states Q^/^'i^^ are bound entangled pro- 
vided that they are entangled. However, the latter still 
needs to be shown. For this purpose below we discuss 
cryptographical applicability of these states. 

Secure key distillation. - We prove that it is possi- 
ble to distill a nonzero amount of cryptographic key from 
the states g^^J^^ . For this aim we show that one can dis- 



till a bipartite secure key between any pair of parties of 
Qaa'i^^ ■ Let us focus on the scenario in which the remain- 
ing iV— 2 parties cooperate "passively" , i.e., they perform 
no action but are trusted (do not cooperate with Eve). 
In this case the distillable key[2^ can only be higher than 
in a scenario in which the remaining N —2 parties would 
give some of their systems to Eve. Thus, for our purposes 
it suffices to investigate the bipartite distillable key of the 

states[25'l P^'^i/ = TrA\{A:j}£'AA'^'* ^'^^ ^ ^ ^ i^'^^^ 
that tracing out the subsystems may be treated as giving 
them to Eve) . As in what follows the additional systems 
are not directly used in secure key distillation and the 
remaining parties are trusted, we can considerably sim- 
plify the analysis by applying the general bipartite cryp- 
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tographical paradigm studied in [1, [T3|- Indeed, we can 
even consider the system A' as one distributed between 
Ak and Ai. However, it does not mean that the consid- 
ered scenario is only bipartite since the total protocol will 
consist of bipartite protocols with different pairs {k, I}. 

We investigate the bipartite distillable key using two 
methods. The first one is quite simple application of 
local filtering, while the second one, probably more ef- 
ficient, bases on the ideas of random distillation of en- 
tanglement given in Refs. [l^, [l^. Both protocols, are 
finally concatenated with the Devetak- Winter (DW) pro- 
tocol [13, [3. 

We also simplify our considerations by imposing some 
constraints on Ud, namely, we assume that all of its en- 



tries obey \uij \ — 1/\AD. An example of such a unitary 
Hermitian matrix is the matrix H^^, with H being the 
Hadamard matrix (here D = 2^). In this case Ud = 



DVD and what is important here ||x|^-*||/||Yq 
D/N, which is greater than one for sufhciently large D. 

Twistings and privacy squeezing. In view of what was 
said previously it suffices to restrict our considerations to 
the distillation of bipartite secure key. The general cryp- 
tographical paradigm of Refs. [1, is exactly what 
we need here. Thus, below we recall some of its main 
ideas, namely, twistings and the privacy squeezing [lo| 
with its application in the recent method :19'] of bounding 
the key form below. Possible multipart ite g eneralizations 
of the paradigm were studied in Refs. ■ 

Let then qab A' B' denote some bipartite state with the 
AB {A'B') part called the key (shield) part (notice once 
more that in general in the considered scenario one does 
not have to demand that the A'B' part belong to the 
involved parties as it may be in possession of some other 
trusted party). Now, let B = {\ij)} denote some product 
basis in the Hilbert space corresponding to the AB part. 
Then one defines the ccq state Qabe ^ state that 

arises upon a measurement of the AB part of a purifica- 
tion I^PabA'B'e) of QAB A'B' in the product basis B and 
tracing out the shield part A'B' (in the usual scenarios 
the shield part is treated then as a trivial subsystem). 

Now, we define twisting (with respect to the basis B) 
to be the following operation: 



Cd being a lower bound on distillable key of original 
state QABA'B'- Let us apply this technique carefully to 
our example with general shield system A'. Firstly, it 
follows from Ref. flO'l that in general KoigAkAiA') = 
Coili'A^AiA'E)) > Gd{QaI%e)^ where |^/'a,a,a'e) stands 

for the purification of qa^AiA'i while Q^a^iE denotes the 
ccq derived according to the aforementioned prescription. 
On the other hand, we can consider a twisted purification 
\'ipt) = Ut® l£;|V'AfcA,A'_E). As previously mentioned the 
ccq state (denoted as (^^a^^ie) following this purification 

is exactly the same as Q^a,^AiE (i'^ Finally, we can con- 
sider a worse situation from the point of secure key dis- 
tillation between the parties Ak and Ai. Namely giving 
now the A' subsystem we can only lower the key. In other 
words, we can look at the twisted purification \ipt) as 
coming from purifying only the A^Ai (with the whole sys- 
tem E' = A'E considered to be in Eve's hands). In this 

way we have C'd{cJaIXe) > (^D{gAl%E')^ where q^aIa.e' 
denotes the ccq state derived in this way. The last step is 

7r(ccq) 
^AkAi. 

I{Ak : E), where 



an application of the Devetak- Winter protocol to QAkAiE 

which gives Cni^2ltE) > nAk-.Ai) 
the quantities [26| I{Ak : Ai) and I{Ak : E) are calcu- 



lated for respective bipartite reductions of 



7r(ccq) 
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conclusion following this analysis is that K]j{gAkAiA') > 

C'D(?Afc"AiE) ^^'^ therefore in what follows we can restrict 

to the analysis of distillable key of QaI'aiE- 

words we need to take privacy-squeezed QaI'a^^ version 

of Q^aI'aX' analyze lower bounds on the distillable 
key of its ccq state. 

Note also that any filtering operation diagonal in B 
and performed on the key part of the state commutes 
with the privacy squeezing operation with respect to the 
same basis. This allows to perform local filters on the 
privacy-squeezed state instead of the initial one p^^J^'*. 

Direct application of local filters. Without loss of gen- 
erality we can assume B to be the standard basis in 
C^. Then we can derive the privacy-squeezed state 
of an arbitrary state gAkA,A' {k 7^ I). Choosing in ^ Uqi 
and uIq to be unitary matrices from the singular -value 

decomposition of X^"^ and Uqq 
after some calculations from Eq. 



dZl) that 



l£)2jv , we get 



where in general Uij denote some isometrics acting on the 
A'B' part. The important fact connected to twistings is 
that QABA'B' and its twisted version UtQABA'B'U} have 
the same ccq state (with respect to the same basis). 

The last concept we would like to mention here is the 
so-called privacy squeezing. Namely, by "rotating" the 
state QABA'B' with some appropriately chosen twisting 
Ut and then tracing out its shield part we get the privacy 
squeezed state qab = T^t: A' B' jUtPABA' B'U})- 

Now, the method applied first in Ref. implies that 
taking the purification \^abe) of the latter and mea- 
suring it in the basis AB produces the ccq state with 
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where ._yK 



N[iN -1)D + i3N^ -3N ~2)/2], odm 



{N^2){N-1)D+[{3N^-11N+12)/2]N, and (3d, n = 
{N -1)D + 2{N -2)N. 

Since aD,N considerably dominates the remaining en- 
tries of 'q'a^Ai , the DW protocol does not apply here. 
However, using some local filters|^ we can change the 
respective entries. So, let us consider the filter = 
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diag[e. 1] (0 < e < 1) and let the fc-th and l-th. party 



apply it. This with probability q\y 



N 



V}V. 1^^^) brings 



Q"a^a^ to the following state 
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with ^£).7v — aD,N€- + 2PD,Nt + N. According to the 
previous prescription what we need now is to bound from 
below the distillable key of the ccq state (in B) of Q^I'ai^ ■ 
For this purpose we can firstly find a lower bound on Co 



of g'"2l'A% using the DW protocol, where by g^^^j"^^ we 
denoted the ccq state 28,] corresponding to the output of 

the filtering, i.e., g^'^''^^ Secondly, as local filtering is 
a stochastic operation, multiplying the latter with the 

success probability 9^^^ we get the desired result. This, 
however, according to the discussion above allows us to 
write 



(ccq.e) 



KoigT^Zl) > q'd'.n mk-.A,) - HAk-.E)] , (12) 

where both / are calculated from reductions of p^^^^*^!;. 

The behaviour of the right-hand side (denoted by K^^^'') 
of Eq. (fT2|) as a function of the filter parameter e and the 
dimension D is plotted in Fig. [T]for N = 3 and N = 5. 
Despite the rather small values of K'j^^'' and the large 
dimension D oi A'^, it is clear from Fig. [T]that one may 
distill a nonzero amount of bipartite key from the states 
gf/'^ and g^^/\ 

Finally, we need to show that indeed the possibility 
of secure key distillation between any pair of parties of 
f?AA^'' leads to the distillation of a genuine multipartite 
secure key among all the parties. For this purpose notice 
firstly that in the general case of an A^-partite state it 
suffices to have a bipartite secure key among pairs AiAi+i 
[i — 1, . . . ,N —\). Secondly, let us assume that each such 
pair distills a secure key at a rate r. Then one concludes 
that in such a configuration all the parties can distill 
multipartite key at a rate at least r/{N — 1). Since we 
showed that in the case of our states r is nonzero, the 
multipartite distillable key of g^^i'^'^ is nonzero, at least 
in the cases of iV = 3, 5. 

Alternative approach: the idea of random distillation 
of secure key. - Now, basing on the very recent results 
of Lo and Fortescue [l^, [l^ , we consider a little bit more 
sophisticated way of the bipartite key distillation from 

£'aa'^^- ^'^^ simplicity we focus here only on the case 
of = 3, however, generalization to more parties is 
straightforward. 

Let us then consider the following POVM % = 
diag[yr^^, 1] and = diag[e,0] (0 < e < 1). It is 
clear that -yj'fe + = I2, where I2 denotes the 

2x2 identity. Each of the parties applies this POVM to 
their "nonprimed" subsystems Ai (i = 1,2,3). Now, we 
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FIG. 1: The dependence of -K^^J^' on the parameters e and D 
for two different values of N , namely, A = 3 (a) and N = 5 
(b). Zero is put whenever the plotted function is less than 
zero. Also, for clarity, the function is plotted as if it were 
continuous in D. It is clear from both the plots that the 
number of parties lowers the plotted function. 



divide the possible outcomes into three groups. The first 
one contains a single element, namely, a result of applica- 
tion of The second group contains the outcome of 
the application of YJ^^ (g) We and two other outcomes be- 
ing permutations of % and W in f;®^ ^ Finally, the 
third group consists of the remaining outcomes. The re- 
sults from the second group are treated as a success since 
they lead to secure key distillation. On the contrary any 
result from the third group is considered as a failure as 
the resulting state has a separable structure with respect 
to the key part. In the case when the obtained result 
belongs to the second or third group, the protocol stops. 
On the other hand, when the result belongs to the first 
group we have to repeat our protocol as the obtained 
result keeps the structure of the initial state. 

Let us now pass to the protocol. Assume that the 
parties repeat the measurement M times, but in such 
way that in each round the value of e in the definition of 
POVM differs. Precisely, following Ref. [lB| we utilize 
Ci = 1/Vl + i, however, in a reversed order, i.e., in the 
first round we take eM = 1/ ^1 + M and in the last one 
ei = 1/2. 

Taking into account a single success outcome 1^®^ (g) We 
(corresponding to the secure key distillation between the 
first and second party), the state after M measurements 
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is of the form pf/^^ = G^^^ /Tr(G^^^), where[2c 



^ f AA' ' EM-l 



of /0^^2 ^ with D — > oo has nonzero ifo by the DW pro- 
tocol and thus, by continuity of the involved functions 
there must exist such D that 'p''^'^ e ^^^o nonzero 
Kd. 




.^1. (13) 



The probability of appearance of p^^'*^^ given by 
(j^*^^ = (2Af2(i:) + 4) + M{2D + 7))/6(i:' + 4)(M + l)^. 

Let us briefly explain Eq. The first term corre- 

sponds to the success obtained in the first round of the 
protocol, while the second term is responsible for the out- 
come from the first group obtained in the first round and 
the success obtained in the second round. The remaining 
terms may be derived in an analogous way. 

Since we chose the success outcome corresponding to 
the key distillation between parties Ai and A2 we can 
trace the key part of the last party of p^^f^,^^\ getting 

the state p^^^ a' • interested in application of 

the DW protocol we can apply the privacy squeezing with 
the same twisting operation Ut as in previous subsection, 
which effectively removes the shield part and produces 
finally 
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where Q^j^^ 
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2[2M(i:i + A) + 2D + 7]/(M + 1). 
The remaining two success outcomes of the POVM 
(corresponding to % and ® f®"^) lead after 

M rounds to exactly the same two-qubit states as in Eq. 
(HU, however, shared by the parties A\ and A3, and A2 
and A3, respectively. Also, probabilities of obtaining the 

respective states are the same and equal to q^u^- Let 
us notice also that in the asymptotic limit M ^ 00 the 

probability g^"* tends to one-third. It means that tak- 
ing into account all the three success outputs we are sure 
that in the limit of M — > 00 the secure bit will be shared 
by one of the pairs of parties. 

Finally, in the same way as previously we get 

KDUA:t^^ ^ ^d'^ [/(^i : A2) - I{A^:E)\ , (15) 

where / are calculated for reductions of the ccq state 

'P^MA^E (i^ ^) '^'^'P^A-iM ■ ^^'^ behavior of the function ap- 
pearing on the right-hand side of the above, i.e., the dif- 
ference between mutual information multiplied by q\f^ 
(denoted by K^w^ is presented in Fig. O On the other 
hand, one may prove analytically that it is possible to get 
a secure key from p^^^^B- Namely, notice that the limit 




FIG. 2: The dependence of Kow on M and D. Zero is put 
whenever the plotted function is less than zero and, for con- 
venience, it is presented as a function of continuous M and 
D. Interestingly, the nonzero values appear at about D — 80, 
while in the analogous plot (Fig. [1^) nonzero values are from 
about D = 2000. Moreover, it is clear that in the case of 
the random protocol the distillable key is bounded by larger 
values. Consequently, it is very reasonable to suspect that by 
using the random protocol one can distill more secure key. 

To finish our considerations we discuss what rates 
of multipartite key are achievable within the described 
method. We already know that to get the multipartite 
key it suffices to have secure key between some properly 
chosen parties. However in previous cases we needed to 
divide protocol into separate A'^ — 1 bipartite determin- 
istic protocols, while here we get different bipartite keys 
in one deterministic protocol. This suggests that we can 
think a little bit clever while estimating the multipartite 
key rate here. 

For this purpose let us focus on the three-partite case 
and and consider the rates ri , r2 , r3 , where ri is a key rate 
between Ai and A2 and so on. Assume that all the rates 
ri are positive and form the triangle inequality. In this 
case there exist a triple of positive numbers a, 6, c such 
that (ri, r2, r^) — {a + b, b + c, c + a) , it is not difficult to 
conclude that the rate of multipartite key may be lower 
bounded by a -I- 6 -I- c = {ri + r2 + '^3)/2. For Paa'^' 
all rates are equal to K^w and the obtainable rate of 
multipartite key is {3/2)K]jw- 

Distillation of a "truly" random secure key - is this 
possible for bound entangled states? In the previous sec- 
tion we have considered random distillation of a secure 
key. In this process all the parties have to cooperate. 
Indeed the performances of the protocol have been es- 
timated with privacy squeezing involving all "primed" 
parties as a shield part. This means that during the pro- 
tocol the passive parties (like A3 in the analysis from the 
previous subsection) were trusted in the sense that keep 
their "primed" subsystems (A3) and do not give it to 
Eve. 

This means that effectively the bipartite key between 
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Ai and A2 can only at this early stage get correlated to 
the third party. But what if we were interested in a true 
random bipartite key, i.e., such that after the random 
bipartite protocol the (random) bipartite key is secure 
not only against Eve but also against other parties? 

This may be also related to a two-stages protocol: 
N trusted parties representing some public company are 
given A^-partite state and distill such random key in a 
way that it is truly bipartite. After that, N different par- 
ties come and use that key having all the bipartite secure 
communications guaranteed. 

Note that this kind of random secure key would share 
with entanglement the monogamy property. The natu- 
ral question is which multipartite bound entangled states 
can lead to the key with such a property. Preliminary 
analysis of our W^-like states seems to suggests that it is 
impossible to get such key form our states. 

Discussion. - We have provided a construction of 
novel multipartite bound entangled states with underly- 
ing W-type structure. The states satisfy PPT test for 
any (TV — 1)|1 partition. We have analyzed distillation 
of a secure key form the states in two different ways. 
The first one is based on the usual bipartite filtering- 
based protocol followed by the DW scheme. The second 
one involves random distillation of secure key. Though 
we have not proven the optimality of the protocols, the 
present results suggest that, as in the entanglement dis- 
tillation, the random distillation of a secure key may be 
much more efficient in the distillation of a multipartite 
cryptographic key in cases when one deals with underly- 
ing W-type structure. However, since the present states 
are the first bound entangled states of this type, still fur- 
ther analysis is necessary. One also expects that bound 
entanglement of other multipartite types like graph states 
(201] may be also constructed and found to be useful in 
quantum cryptography. It is interesting to address this 
type of questions in the context of recently discovered 



thermal bound entanglement in quantum arrays and lat- 
tices [2l[. On the other hand, one may ask about the 
distillation of a quantum key in a modified sense: this 
would be the "truly" random bipartite key in the sense 
that bipartite cryptographic correlations were secure not 
only against Eve but also against all the remaining par- 
ties. Note that, of course this is possible in case of some 
free entangled states: Lo-Fortesque protocol followed by 
classical measurement of entangled pairs provides natu- 
rally such key. Here the natural question arises which 
bound entangled states lead to such key. 

Another natural question concerns the relation of the 
present results to quantum channels capacities. Indeed 
the present states as well as the states from [l^ may be 
immediately used to generate a quantum channel (with 
k senders and n — k receivers). It is interesting that 
while the one-sender channels created from the GHZ- 
type states fl3| have strictly positive one-way multipar- 
tite privacy capacity V nonzero (due to generalized DW 
protocol) it seems to be rather unlikely that the channels 
based on the present VF-like states have that property. 
Still, in context of fascinating and still uncovered role of 
privacy in the recently discovered superactivation effect 
of quantum bipartite capacity [2^ . and especially in the 
context of multipartite superactivation and activation of 
quantum capacities and entanglement (see [23|). further 
analysis of quantum channels based on the present states 
seems to be interesting. 



Acknowledgments 

The work is supported by EU Integrated Project 
SCALA and by LFPPI network. R. A. gratefully ac- 
knowledges the support from Ingenio 2010 QOIT and 
Foundation for Polish Science. 



[1] Bennett C. H. and Brassard G., Quantum cryptograptiy: 
Public key distribution and coin tossing, in Proceedings of 
the IEEE International Conference on Computers, Sys- 
tems and Signal Processing, Bangalore, India, December, 
1984 (IEEE Computer Society Press, New York) p. 175. 

[2] A. K. Ekert, Phys. Rev. Lett. 67, 661 (1991). 

[3] P. W. Shor and J. Preskill, Phys. Rev. Lett. 85, 441 
(2000). 

[4] H.-K. Lo and H. F. Chan, Science 283, 2050 (1999). 
[5] D. Deutsch, A. K. Ekert, R. Jozsa, C. Macchiavello, S. 

Popescu, and A. Sanpera, Phys. Rev. Lett. 77, 2818 

(1996). 

[6] C. H. Bennett, G. Brassard, S. Popescu, B. Schumacher, 
J. A. Smolin and W. K. Wootters, Phys. Rev. Lett. 76, 
722 (1996). 

[7] M. Curty, M. Lewenstein and N. Liitkenhaus, Phys. Rev. 

Lett. 92, 217903 (2004). 
[8] M. Horodecki, P. Horodecki, and R. Horodecki, Phys. 

Rev. Lett. 80, 5239 (1998). 



[9] K. Horodecki, M. Horodecki, P. Horodecki and J. Oppen- 
heim, Phys. Rev. Lett. 94, 160502 (2005). 

[10] K. Horodecki, M. Horodecki, P. Horodecki and J. Oppen- 
heim, IEEE Trans. Inf. Theor. 55, 1898 (2009). 

[11] J. M. Renes, G. Smith, Phys. Rev. Lett. 98, 020502 

(2007) . 

[12] J. M. Renes, J.-Ch. Boileau, Phys. Rev. A 78, 032335 

(2008) . 

[13] R. Augusiak, On the distillation of secure key form mul- 
tipartite entangled quantum states, PhD thesis, Gdansk, 
2008. 

[14] R. Augusiak and P. Horodecki, Multipartite secret key 
distillation and bound entanglement , larXiv:08ll .3603 1 
in press in Phys. Rev. A. 

[15] H.-K. Lo and B. Fortescue, Phys. Rev. Lett. 98, 260501 

(2007) . 

[16] H.-K. Lo and B. Fortescue, Phys. Rev. A 78, 012348 

(2008) . 

[17] I. Devetak and A. Winter, Phys. Rev. Lett. 93, 080501 



7 



(2004). 

[18] I. Devetak and A. Winter, Proc. R. Soc. Lond. A 461, 
207 (2005). 

[19] K. Horodecki, L. Pankowski, M. Horodecki and P. 

Horodecki, IEEE Trans. Inf. Theory 54, 2621 (2008). 
[20] R. Raussendorf, D. Browne and H.-J. Briegel, Phys. Rev. 

A 68, 022312 (2003). 
[21] G. Toth, C. Knapp, O. Guhne and H. J. Briegel, Phys. 

Rev. Lett. 99, 250405 (2007); A. Ferraro, D. Caval- 

canti, A. Garcia-Saez and A. Acm, Phys. Rev. Lett. 100, 

080502 (2008). 
[22] G. Smith and J. Yard, Science 321, 1812 (2008). 
[23] P. W. Shor, J. A. Smolin and A. V. Thapliyal, Phys. 

Rev. Lett. 90, 107901 (2003); W. Diir, J. I. Cirac and P. 

Horodecki, Phys. Rev. Lett 93, 020503 (2004); L. Czekaj 

and P. Horodecki, Phys. Rev. Lett. 102, 110505 (2009). 
[24] For definitions of the bipartite and multipartite distillable 



key Cd and Kd the reader is referred to [T^j and 
[la . [T^ , respectively. 

[25] The notation TrA\{fc,i} means that we trace out the A 
subsystem except for and Ai subsystems. 

[26] The quantum mutual information I{A:B) is defined for 
QAB as I{A:B) = S{gA) + Sign) ~ S{gAB) with S de- 
noting the von Neumann entropy. 

[27] Physically the filters are performed on subsystems of the 
key part of g^^!^^ by respective parties, however as they 
commute with the privacy squeezing we can mathemati- 
cally perform it on 

[28] For the sake of clearity, we do not provide explicit form 
of the purification of and ccq state 'g^'^^fE- 

[29] By and we denoted POVM operators extended by 
the identity on A' subsystems. 



